|
<distribution-code display="yes">II</distribution-code><calendar>Calendar No. 348</calendar><congress>117th CONGRESS</congress><session>2d Session</session><legis-num>S. 1324</legis-num><associated-doc role="report">[Report No. 117–97]</associated-doc><current-chamber>IN THE SENATE OF THE UNITED STATES</current-chamber><action><action-date date="20210422">April 22, 2021</action-date><action-desc><sponsor name-id="S402">Ms. Rosen</sponsor> (for herself and <cosponsor name-id="S396">Mrs. Blackburn</cosponsor>) introduced the following bill; which was read twice and referred to the <committee-name committee-id="SSGA00" added-display-style="italic" deleted-display-style="strikethrough">Committee on Homeland Security and Governmental Affairs</committee-name></action-desc></action><action stage="Reported-in-Senate"><action-date date="20220428">April 27, 2022</action-date><action-desc>Reported by <sponsor name-id="S380">Mr. Peters</sponsor>, with an amendment</action-desc><action-instruction>Strike out all after the enacting clause and insert the part printed in italic</action-instruction></action><legis-type>A BILL</legis-type><official-title>To establish a Civilian Cyber Security Reserve as a pilot project to address the cyber security needs of the United States with respect to national security, and for other purposes.</official-title></form><legis-body><section id="S1" section-type="section-one" changed="deleted" reported-display-style="strikethrough" committee-id="SSGA00"><enum>1.</enum><header>Short title</header><text display-inline="no-display-inline">This Act may be cited as the <quote><short-title>Civilian Cyber Security Reserve Act</short-title></quote>.</text></section><section section-type="subsequent-section" id="id43A7302ABB8544118A692FFB4F5F9D73" changed="deleted" reported-display-style="strikethrough" committee-id="SSGA00"><enum>2.</enum><header>Civilian Cyber Security Reserve pilot project</header><subsection id="id9629880f1cde4fdf89da671969deec0e"><enum>(a)</enum><header>Definitions</header><text>In this section:</text><paragraph id="idB336D68437C64513AB2458B5439AF522"><enum>(1)</enum><header>Appropriate agency head</header><text>The term <term>appropriate agency head</term> means—</text><subparagraph id="id0EE26573DE83451D94946B15A507B6AF"><enum>(A)</enum><text>in the case of the Department of Homeland Security, the Secretary of Homeland Security; and</text></subparagraph><subparagraph id="id0376332C246F42079345AA90E815EC99"><enum>(B)</enum><text>in the case of the Department of Defense, the Secretary of Defense.</text></subparagraph></paragraph><paragraph id="id8c47ed16a7a34be89dffb23a842a8a46"><enum>(2)</enum><header>Competitive service</header><text>The term <term>competitive service</term> has the meaning given the term in section 2102 of title 5, United States Code.</text></paragraph><paragraph id="ida3b4360968e747b988500368aaacd432"><enum>(3)</enum><header>Covered agency</header><text>The term <term>covered agency</term> means the Department of Homeland Security or the Department of Defense.</text></paragraph><paragraph id="id02db54247f0f4c67b7caa280ca2885dd"><enum>(4)</enum><header>Excepted service</header><text>The term <term>excepted service</term> has the meaning given the term in section 2103 of title 5, United States Code. </text></paragraph><paragraph id="id49907494AE1A4D709E0F5FA438ADB821"><enum>(5)</enum><header>Temporary</header><text>The term <term>temporary</term> means a period of not more than 6 months.</text></paragraph><paragraph id="ideede89d5c1c34deaa35a8c99b4e45a85"><enum>(6)</enum><header>Uniformed services</header><text>The term <term>uniformed services</term> has the meaning given the term in section 2101 of title 5, United States Code.</text></paragraph></subsection><subsection id="id6d382610ad7e444ba8f0297e7df157ef"><enum>(b)</enum><header>Pilot project</header><paragraph id="id4142af022ad64d0497b5a9446ef4aef1"><enum>(1)</enum><header>In general</header><text>Each appropriate agency head may carry out a pilot project to establish a Civilian Cyber Security Reserve at the covered agency to address the cyber security needs of the United States with respect to national security.</text></paragraph><paragraph id="id829b5ce572ba4bcd99f18086f9fbf6d5"><enum>(2)</enum><header>Appointments</header><text>Under a pilot project authorized under paragraph (1), the appropriate agency head may noncompetitively appoint members of the Civilian Cyber Security Reserve to temporary positions in the competitive or excepted service.</text></paragraph><paragraph id="idedf1978d3ea845758744e1ebd79cfb5a"><enum>(3)</enum><header>Status as employees</header><text>An individual appointed under paragraph (2) shall be considered a Federal civil service employee under section 2105 of title 5, United States Code. </text></paragraph><paragraph id="id07D31584B27447CB97CD3BE6094A21FF"><enum>(4)</enum><header>Additional employees</header><text>Individuals appointed under paragraph (2) shall be in addition to any employees of the covered agency who provide cyber security services.</text></paragraph><paragraph id="id3BFDF0BB788C4F66A4B28FBC141DC003"><enum>(5)</enum><header>Employment protections</header><text>The Secretary of Labor shall prescribe such regulations as necessary to ensure the reemployment, continuation of benefits, and non-discrimination in reemployment of individuals appointed under paragraph (2), provided that such regulations shall include, at a minimum, those rights and obligations set forth under <external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/38/43">chapter 43</external-xref> of title 38, United States Code. </text></paragraph></subsection><subsection id="idc29389cf075c496798c66caebb86396d"><enum>(c)</enum><header>Eligibility; application and selection</header><paragraph id="id53AA60891DE94D78B124F799C238B93F"><enum>(1)</enum><header>In general</header><text>Under a pilot project authorized under subsection (b), the appropriate agency head shall establish criteria for—</text><subparagraph id="id8108EDC100C4469D86115C5AFB6A624D"><enum>(A)</enum><text>individuals to be eligible for the Civilian Cyber Security Reserve in the covered agency; and</text></subparagraph><subparagraph id="idF0A163BC67BB4CB09351B640722DEA04"><enum>(B)</enum><text>the application and selection processes for the Reserve.</text></subparagraph></paragraph><paragraph id="idDB026443CA8B44DB9D2ABEE652736F05"><enum>(2)</enum><header>Requirements for individuals</header><text>The criteria established under paragraph (1)(A) with respect to an individual shall include—</text><subparagraph id="id799F46AC03934D6B897CF73D142D8815"><enum>(A)</enum><text>previous employment by the Federal Government or within the uniformed services; and</text></subparagraph><subparagraph id="id6D3FF14AC2F5435F962115FF72ED45E9"><enum>(B)</enum><text>cyber security expertise.</text></subparagraph></paragraph><paragraph id="id667E9480FEC147D89DBEBB1493E4E1B0"><enum>(3)</enum><header>Agreement required</header><text>An individual may become a member of the Civilian Cyber Security Reserve only if the individual enters into an agreement with the appropriate agency head to become such a member, which shall set forth the rights and obligations of the individual and the covered agency.</text></paragraph><paragraph id="id4FC9181EF84C4CDCB54135756EB64F83"><enum>(4)</enum><header>Exception for continuing military service commitments</header><text>A member of the Selected Reserve under section 10143 of title 10, United States Code, may not be a member of the Civilian Cyber Security Reserve.</text></paragraph></subsection><subsection id="idc317e4bb868345dcbeb31eda3e7372cf"><enum>(d)</enum><header>Components of the Civilian Cyber Security Reserve</header><text>The appropriate agency head may consider, in carrying out a pilot project authorized under subsection (b), developing different components of the Civilian Cyber Security Reserve in the covered agency, one with an obligation to respond when called into activation at the direction of the appropriate agency head and one that is not compelled to so respond, with appropriate corresponding differing benefits for each such component.</text></subsection><subsection id="ide411413270234c1eba9c435e88736c75"><enum>(e)</enum><header>Security clearances</header><paragraph id="id285324B5E19E408F9500C9138C74B63C"><enum>(1)</enum><header>In general</header><text>The appropriate agency head shall ensure that all members of the Civilian Cyber Security Reserve in the covered agency undergo the appropriate personnel vetting and adjudication commensurate with the duties of the position, including a determination of eligibility for access to classified information where a security clearance is necessary, in accordance with Executive Order 12968 (<external-xref legal-doc="usc" parsable-cite="usc/50/3161">50 U.S.C. 3161</external-xref> note; relating to access to classified information) and Executive Order 13467 (<external-xref legal-doc="usc" parsable-cite="usc/50/3161">50 U.S.C. 3161</external-xref> note; relating to reforming processes related to suitability for Government employment, fitness for contractor employees, and eligibility for access to classified national security information). </text></paragraph><paragraph id="id9C3A7B0960BF4CF99597E4595E1AA128"><enum>(2)</enum><header>Cost of maintaining clearances</header><text>The original sponsor of a security clearance of a member of a Civilian Cyber Security Reserve at a covered agency shall be responsible for the cost of maintaining that security clearance.</text></paragraph></subsection><subsection id="id21b720c38f044ba6af2f572c4b5481b6"><enum>(f)</enum><header>Project guidance</header><paragraph id="id581e0f808bca420796c1c81d500044d3"><enum>(1)</enum><header>In general</header><text>Not later than 180 days after the date of enactment of this Act, each appropriate agency head may issue guidance establishing and implementing a pilot project authorized under subsection (b) at the covered agency.</text></paragraph><paragraph id="id6332cdf367c24082bb9bd881d41f1b27"><enum>(2)</enum><header>Penalties</header><subparagraph id="id6F9E8E3BF7144A57A9D944A6CADE5171"><enum>(A)</enum><header>In general</header><text>In developing guidance under paragraph (1), an appropriate agency head may provide for penalties for individuals who do not respond to activation when called, such as recoupment of pay or benefits earned as a member of the Civilian Cyber Security Reserve or recoupment of civilian service creditable under section 8411 of title 5, United States Code.</text></subparagraph><subparagraph id="id3bca8721b1144e9f9097ee115cfa2f1c"><enum>(B)</enum><header>Procedures</header><text>In the case of a proposed penalty or action under this paragraph, the individual shall be entitled to the applicable procedures set forth in title 5, Code of Federal Regulations, or as otherwise specified in applicable guidance. </text></subparagraph></paragraph></subsection><subsection id="id2e37b6100f68449cad2ff9ae2b99f1d6"><enum>(g)</enum><header>Evaluation</header><text>Not later than 5 years after the pilot project authorized under subsection (b) is established in each covered agency, the Comptroller General of the United States shall—</text><paragraph id="idBFA7F16EF0ED492E9D64745D21469F40"><enum>(1)</enum><text>conduct a study evaluating the pilot project at the covered agency; and</text></paragraph><paragraph id="id62BB5DE9255744E2A8D9EE248066555E"><enum>(2)</enum><text>submit to Congress—</text><subparagraph id="idE88D5210CE3546E6BE9530E9BCF0B3A7"><enum>(A)</enum><text>a report on the results of the study; and</text></subparagraph><subparagraph id="id124A22BDF0E84BD2B97E8AD6E48D9F8B"><enum>(B)</enum><text>a recommendation with respect to whether the pilot project should be modified, extended in duration, or established as a permanent program.</text></subparagraph></paragraph></subsection><subsection id="id05ACBE07C8D1476E94196D7AC042B7E6"><enum>(h)</enum><header>Report</header><text>Not later than 5 years after the pilot project authorized under subsection (b) is established in a covered agency, the appropriate agency head shall submit to the Committee on Homeland Security and Governmental Affairs and the Committee on Armed Services of the Senate and the Committee on Homeland Security and the Committee on Armed Services of the House of Representatives a report—</text><paragraph id="idEC04CFEF53C242EEBFC3B43A7E8FC70E"><enum>(1)</enum><text>on the activities carried out under the pilot project; and</text></paragraph><paragraph id="id3E2F76925DAD4E72857C83DB03F318FC"><enum>(2)</enum><text>that includes a recommendation with respect to whether the pilot project should be modified, extended in duration, or established as a permanent program.</text></paragraph></subsection><subsection id="idF21D35E887894A178E1FA9A814616B6B"><enum>(i)</enum><header>Sunset</header><text>A pilot project authorized under this section shall terminate on the date that is 6 years after the date on which the pilot project is established.</text></subsection><subsection id="id9b2f8cb60b3f4f51ba2c8ede2b561d06"><enum>(j)</enum><header>Authorization of appropriations</header><text>There are authorized to be appropriated to each appropriate agency head such sums as may be necessary to carry out this section.</text></subsection></section></legis-body><legis-body display-enacting-clause="no-display-enacting-clause"><section id="id0A041DBF2C19453BB2A41E373FAA0407" section-type="section-one" changed="added" reported-display-style="italic" committee-id="SSGA00"><enum>1.</enum><header>Short title</header><text display-inline="no-display-inline">This Act may be cited as the <quote><short-title>Civilian Cybersecurity Reserve Act</short-title></quote>.</text></section><section section-type="subsequent-section" id="id2e6f0ab6-39ef-4de9-9dc3-cfc587ee13e3" changed="added" reported-display-style="italic" committee-id="SSGA00"><enum>2.</enum><header>Civilian Cybersecurity Reserve pilot project</header><subsection id="id7ddfafeb-93ba-4812-8a4a-ff26b2af485a"><enum>(a)</enum><header>Definitions</header><text>In this section:</text><paragraph id="id313D758810614A4BAC64FBB6068AC8B6"><enum>(1)</enum><header>Agency</header><text>The term <term>Agency</term> means the Cybersecurity and Infrastructure Security Agency.</text></paragraph><paragraph id="id28ADF2E9CBD7419E97FD590B0F29586D"><enum>(2)</enum><header>Appropriate congressional committees</header><text>The term <term>appropriate congressional committees</term> means—</text><subparagraph id="idC79755B7167549B9B92DB0C70D51781A"><enum>(A)</enum><text>the Committee on Homeland Security and Governmental Affairs of the Senate;</text></subparagraph><subparagraph id="id8F3F607A9B4B42A2B5F6D946B9B51E1B"><enum>(B)</enum><text>the Committee on Appropriations of the Senate;</text></subparagraph><subparagraph id="id8E6603CB7E7E41F49F1F48E62567B217"><enum>(C)</enum><text>the Committee on Homeland Security of the House of Representatives; </text></subparagraph><subparagraph id="idC91A2F094748417296CCB5DEC19C1686"><enum>(D)</enum><text>the Committee on Oversight and Reform of the House of Representatives; and</text></subparagraph><subparagraph id="id5C9DF12B0F8F4615AD2AD0C6FC0D0174" commented="no" display-inline="no-display-inline"><enum>(E)</enum><text>the Committee on Appropriations of the House of Representatives. </text></subparagraph></paragraph><paragraph id="idd0f53bf3-8316-4563-ba43-e0a3f98cb815"><enum>(3)</enum><header>Competitive service</header><text>The term <term>competitive service</term> has the meaning given the term in section 2102 of title 5, United States Code.</text></paragraph><paragraph id="id1E9B1AD217A74D2A88C18DA687B25ED2"><enum>(4)</enum><header>Director</header><text>The term <term>Director</term> means the Director of the Agency.</text></paragraph><paragraph id="id882f60e1-5f8a-47b1-a778-5f2b82db5d9f"><enum>(5)</enum><header>Excepted service</header><text>The term <term>excepted service</term> has the meaning given the term in section 2103 of title 5, United States Code. </text></paragraph><paragraph id="id758BB22C72B84B09858832CC6C4A3F57"><enum>(6)</enum><header>Significant incident</header><text>The term <term>significant incident</term>—</text><subparagraph id="id8b5877df22dd415881dd36ceba917d5e"><enum>(A)</enum><text>means an incident or a group of related incidents that results, or is likely to result, in demonstrable harm to—</text><clause id="id4e1118bf027c4a1d94e183170736736f"><enum>(i)</enum><text>the national security interests, foreign relations, or economy of the United States; or</text></clause><clause id="id381659ca4052457aaf1d55b8b66c5a4d"><enum>(ii)</enum><text>the public confidence, civil liberties, or public health and safety of the people of the United States; and</text></clause></subparagraph><subparagraph id="idcad21e94180549a6a5ba5ae36010cd31"><enum>(B)</enum><text>does not include an incident or a portion of a group of related incidents that occurs on—</text><clause id="idb5c2844fd34b49ce897675038006e922"><enum>(i)</enum><text>a national security system, as defined in section 3552 of title 44, United States Code; or</text></clause><clause id="id4bbb94753c30446fa9b732f276d8f0df"><enum>(ii)</enum><text>an information system described in paragraph (2) or (3) of section 3553(e) of title 44, United States Code.</text></clause></subparagraph></paragraph><paragraph id="idc5231c00-23fd-4278-a294-03875e3c73d8"><enum>(7)</enum><header>Temporary position</header><text>The term <term>temporary position</term> means a position in the competitive or excepted service for a period of 6 months or less.</text></paragraph><paragraph id="id8462e015-4a11-41f8-89d1-542f499dcbbd"><enum>(8)</enum><header>Uniformed services</header><text>The term <term>uniformed services</term> has the meaning given the term in section 2101 of title 5, United States Code.</text></paragraph></subsection><subsection id="id82a582ca-84ad-4e71-b02c-e80e16264aa2"><enum>(b)</enum><header>Pilot project</header><paragraph id="id66a15a15-7b0d-429b-8500-d54dc856f9a5"><enum>(1)</enum><header>In general</header><text>The Director may carry out a pilot project to establish a Civilian Cybersecurity Reserve at the Agency.</text></paragraph><paragraph id="id4E8D5FDC9AAB4A95A8703ED0961E4F2C"><enum>(2)</enum><header>Purpose</header><text>The purpose of a Civilian Cybersecurity Reserve is to enable the Agency to effectively respond to significant incidents. </text></paragraph><paragraph id="id3895A1A6B9A841809BBE15AC96885EA8"><enum>(3)</enum><header>Alternative methods</header><text>Consistent with section 4703 of title 5, United States Code, in carrying out a pilot project authorized under paragraph (1), the Director may, without further authorization from the Office of Personnel Management, provide for alternative methods of—</text><subparagraph id="id00E7506AE0AF47798CF794FE9ACD3FBC"><enum>(A)</enum><text>establishing qualifications requirements for, recruitment of, and appointment to positions; and</text></subparagraph><subparagraph id="idC6CC6E0AD83645998444B605417AE61E"><enum>(B)</enum><text>classifying positions.</text></subparagraph></paragraph><paragraph id="ida0f8a017-8b64-4c50-ae8c-9ad42f03a2d5"><enum>(4)</enum><header>Appointments</header><text>Under the pilot project authorized under paragraph (1), upon occurrence of a significant incident, the Director—</text><subparagraph id="id923A9885FEC44C2992418BB5D07EF259"><enum>(A)</enum><text>may activate members of the Civilian Cybersecurity Reserve by—</text><clause id="id356DBA7B683549D8BFCC31D6FFD24C3F"><enum>(i)</enum><text>noncompetitively appointing members of the Civilian Cybersecurity Reserve to temporary positions in the competitive service; or </text></clause><clause id="id5B4832E4E1B24B10945E2A0AA2BFE949"><enum>(ii)</enum><text>appointing members of the Civilian Cybersecurity Reserve to temporary positions in the excepted service; </text></clause></subparagraph><subparagraph id="idB318818E5D0A4AC38389C43D87734AC3"><enum>(B)</enum><text>shall notify Congress whenever a member is activated under subparagraph (A); and</text></subparagraph><subparagraph id="id45BF970A164649E4B89BD3686B6337BF"><enum>(C)</enum><text>may appoint not more than 30 members to the Civilian Cybersecurity Reserve under subparagraph (A) at any time. </text></subparagraph></paragraph><paragraph id="id914ab75d-e5d8-4595-ada8-6d570f13a47c"><enum>(5)</enum><header>Status as employees</header><text>An individual appointed under subsection (b)(4) shall be considered a Federal civil service employee under section 2105 of title 5, United States Code. </text></paragraph><paragraph id="idfdc7d83b-2c6a-4da8-8dfb-931af0a3f4d1"><enum>(6)</enum><header>Additional employees</header><text>Individuals appointed under subsection (b)(4) shall be in addition to any employees of the Agency who provide cybersecurity services.</text></paragraph><paragraph id="iddc9a4d73-2086-4732-b721-3a72e50e20b4"><enum>(7)</enum><header>Employment protections</header><text>The Secretary of Labor shall prescribe such regulations as necessary to ensure the reemployment, continuation of benefits, and non-discrimination in reemployment of individuals appointed under subsection (b)(4), provided that such regulations shall include, at a minimum, those rights and obligations set forth under <external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/38/43">chapter 43</external-xref> of title 38, United States Code. </text></paragraph><paragraph id="id3bd57015c188459eb3cb447619d52ff2"><enum>(8)</enum><header>Status in reserve</header><text>During the period beginning on the date on which an individual is recruited by the Agency to serve in the Civilian Cybersecurity Reserve and ending on the date on which the individual is appointed under subsection (b)(4), and during any period in between any such appointments, the individual shall not be considered a Federal employee. </text></paragraph></subsection><subsection id="id801b07a8-9738-4a93-bfd8-d2b8fee7d8f0"><enum>(c)</enum><header>Eligibility; application and selection</header><paragraph id="ida74b7eaf-ab30-4b0a-8c1a-0552dacbb74a"><enum>(1)</enum><header>In general</header><text>Under the pilot project authorized under subsection (b), the Director shall establish criteria for—</text><subparagraph id="idf701eb7c-81d9-442c-834a-601c834fe7e4"><enum>(A)</enum><text>individuals to be eligible for the Civilian Cybersecurity Reserve; and</text></subparagraph><subparagraph id="idece58ee0-2620-4de9-ab50-6091ebcdd499"><enum>(B)</enum><text>the application and selection processes for the Civilian Cybersecurity Reserve.</text></subparagraph></paragraph><paragraph id="idf086dabf-5fad-4e1a-a808-1896ef566bf4"><enum>(2)</enum><header>Requirements for individuals</header><text>The criteria established under paragraph (1)(A) with respect to an individual shall include—</text><subparagraph id="id518DEE3F01EF41C1AAB84C86BD4A3FDB"><enum>(A)</enum><text>previous employment—</text><clause id="id53574A58486444758818F40A4EEC5572"><enum>(i)</enum><text>by the executive branch;</text></clause><clause id="idD4B72EC805594D58A303D91BDBAB1259"><enum>(ii)</enum><text>within the uniformed services;</text></clause><clause id="idB36C9F3B3CBC4FE4BA693BFDD6D58611"><enum>(iii)</enum><text>as a Federal contractor within the executive branch; or</text></clause><clause id="id6DB7A0BAAD084252AE68F3543A700B57"><enum>(iv)</enum><text>by a State, local, Tribal, or territorial government;</text></clause></subparagraph><subparagraph id="id86173A8DF89840328FE5576EF6ADEEF3"><enum>(B)</enum><text>if the individual has previously served as a member of the Civilian Cybersecurity Reserve of the Agency, that the previous appointment ended not less than 60 days before the individual may be appointed for a subsequent temporary position in the Civilian Cybersecurity Reserve of the Agency; and</text></subparagraph><subparagraph id="idec7f9569-54ae-41c8-864a-028088f036c9"><enum>(C)</enum><text>cybersecurity expertise.</text></subparagraph></paragraph><paragraph id="id3337914F083D46D282F941AC4C5E68DC"><enum>(3)</enum><header>Prescreening</header><text>The Agency shall—</text><subparagraph id="id8A97626F69934F05BAD263A818212A96"><enum>(A)</enum><text>conduct a prescreening of each individual prior to appointment under subsection (b)(4) for any topic or product that would create a conflict of interest; and</text></subparagraph><subparagraph id="id0557C19352E34EEEA861F3A535CE5F42"><enum>(B)</enum><text>require each individual appointed under subsection (b)(4) to notify the Agency if a potential conflict of interest arises during the appointment.</text></subparagraph></paragraph><paragraph id="id6b1b1f54-8d62-47a8-90ce-13db070b756c"><enum>(4)</enum><header>Agreement required</header><text>An individual may become a member of the Civilian Cybersecurity Reserve only if the individual enters into an agreement with the Director to become such a member, which shall set forth the rights and obligations of the individual and the Agency.</text></paragraph><paragraph id="id81a3dc6b-7d70-4b79-87c4-529511aa6167"><enum>(5)</enum><header>Exception for continuing military service commitments</header><text>A member of the Selected Reserve under section 10143 of title 10, United States Code, may not be a member of the Civilian Cybersecurity Reserve.</text></paragraph><paragraph id="id1C3B5817393A4B61A8FFACD2E9535AA5"><enum>(6)</enum><header>Priority</header><text>In appointing individuals to the Civilian Cybersecurity Reserve, the Agency shall prioritize the appointment of individuals described in clause (i) or (ii) of paragraph (2)(A) before considering individuals described in clause (iii) or (iv) of paragraph (2)(A). </text></paragraph><paragraph id="idE03748FD111640149F90BBCE28E09B6D"><enum>(7)</enum><header>Prohibition</header><text>Any individual who is an employee of the executive branch may not be recruited or appointed to serve in the Civilian Cybersecurity Reserve.</text></paragraph></subsection><subsection id="idfe96c40e-d840-4739-82dd-bdb1e0b7f798"><enum>(d)</enum><header>Security clearances</header><paragraph id="id07134048-c1e5-4af2-9737-9ad1cb5f8426"><enum>(1)</enum><header>In general</header><text>The Director shall ensure that all members of the Civilian Cybersecurity Reserve undergo the appropriate personnel vetting and adjudication commensurate with the duties of the position, including a determination of eligibility for access to classified information where a security clearance is necessary, according to applicable policy and authorities. </text></paragraph><paragraph id="idfa52de11-e8b8-47d9-8fc6-eb7c8cfb76ee"><enum>(2)</enum><header>Cost of sponsoring clearances</header><text>If a member of the Civilian Cybersecurity Reserve requires a security clearance in order to carry out their duties, the Agency shall be responsible for the cost of sponsoring the security clearance of a member of the Civilian Cybersecurity Reserve.</text></paragraph></subsection><subsection id="id47DFBF50819E42F88D2B52AF28DF6E89"><enum>(e)</enum><header>Study and implementation plan</header><paragraph id="id848d7743f18e48f498cf54a6d154c600"><enum>(1)</enum><header>Study</header><text>Not later than 60 days after the date of enactment of this Act, the Agency shall begin a study on the design and implementation of the pilot project authorized under subsection (b)(1) at the Agency, including—</text><subparagraph id="id4ad2ebb7c332403f85b9b82a46cba20a"><enum>(A)</enum><text>compensation and benefits for members of the Civilian Cybersecurity Reserve;</text></subparagraph><subparagraph id="ida8f1e2eed6b541e3a0ff5c6311657340"><enum>(B)</enum><text>activities that members may undertake as part of their duties;</text></subparagraph><subparagraph id="idaeb48e6a6ac3450a89829691edada91a"><enum>(C)</enum><text>methods for identifying and recruiting members, including alternatives to traditional qualifications requirements;</text></subparagraph><subparagraph id="id60cec5cc8ef64a19bc4d997fbe981f95"><enum>(D)</enum><text>methods for preventing conflicts of interest or other ethical concerns as a result of participation in the pilot project and details of mitigation efforts to address any conflict of interest concerns;</text></subparagraph><subparagraph id="id1b3ab5ca13594c7ca2c1ec0376076e20"><enum>(E)</enum><text>resources, including additional funding, needed to carry out the pilot project;</text></subparagraph><subparagraph id="idebbde8599c7a4ff3a45ec300035413f9"><enum>(F)</enum><text>possible penalties for individuals who do not respond to activation when called, in accordance with the rights and procedures set forth under title 5, Code of Federal Regulations; and</text></subparagraph><subparagraph id="id04e11ccfc77a4cc8a36189765f08d0c3"><enum>(G)</enum><text>processes and requirements for training and onboarding members.</text></subparagraph></paragraph><paragraph id="id8cc7e29c027849d488f168d5a831b504"><enum>(2)</enum><header>Implementation plan</header><text>Not later than 1 year after beginning the study required under paragraph (1), the Agency shall—</text><subparagraph id="id72AC7E6E0D41487B85E0242FCA6BB68F"><enum>(A)</enum><text>submit to the appropriate congressional committees an implementation plan for the pilot project authorized under subsection (b)(1); and</text></subparagraph><subparagraph id="idFEBB041EA31D4D059EFB18B8BFA88D77"><enum>(B)</enum><text>provide to the appropriate congressional committees a briefing on the implementation plan.</text></subparagraph></paragraph><paragraph id="idD710CB7896B448E9A86067D48C72EA9C"><enum>(3)</enum><header>Prohibition</header><text>The Agency may not take any action to begin implementation of the pilot project authorized under subsection (b)(1) until the Agency fulfills the requirements under paragraph (2).</text></paragraph></subsection><subsection id="ide264db87-94f2-4bda-9226-4440f6f61e5b"><enum>(f)</enum><header>Project guidance</header><text>Not later than 2 years after the date of enactment of this Act, the Director shall, in consultation with the Office of Personnel Management and the Office of Government Ethics, issue guidance establishing and implementing the pilot project authorized under subsection (b)(1) at the Agency. </text></subsection><subsection id="id7EC2E4E7748F4C99847846600A5013FD"><enum>(g)</enum><header>Briefings and report</header><paragraph id="idD549E84052A343608F3567243A9B8CB5"><enum>(1)</enum><header>Briefings</header><text>Not later than 1 year after the date of enactment of this Act, and every year thereafter, the Agency shall provide to the appropriate congressional committees a briefing on activities carried out under the pilot project of the Agency, including—</text><subparagraph id="idda1503c87e6e4924bcbeb2abd581db4d"><enum>(A)</enum><text>participation in the Civilian Cybersecurity Reserve, including the number of participants, the diversity of participants, and any barriers to recruitment or retention of members;</text></subparagraph><subparagraph id="id698013b45dee47bf8037bf3408fb0028"><enum>(B)</enum><text>an evaluation of the ethical requirements of the pilot project; </text></subparagraph><subparagraph id="id6ca503d805c442e3b467d20ec11e59a1"><enum>(C)</enum><text>whether the Civilian Cybersecurity Reserve has been effective in providing additional capacity to the Agency during significant incidents; and</text></subparagraph><subparagraph id="id87E55DBD74304859945EDFD4EF3CF4E6"><enum>(D)</enum><text>an evaluation of the eligibility requirements for the pilot project. </text></subparagraph></paragraph><paragraph id="id6C5A5D4CED83428E96B2DA2C01C10BD4"><enum>(2)</enum><header>Report</header><text>Not earlier than 6 months and not later than 3 months before the date on which the pilot project of the Agency terminates under subsection (i), the Agency shall submit to the appropriate congressional committees a report and provide a briefing on recommendations relating to the pilot project, including recommendations for—</text><subparagraph id="idC679B9E0F27849DBA7C36198012A9376"><enum>(A)</enum><text>whether the pilot project should be modified, extended in duration, or established as a permanent program, and if so, an appropriate scope for the program;</text></subparagraph><subparagraph id="id60179705F41145978E5E7109F6792F57"><enum>(B)</enum><text>how to attract participants, ensure a diversity of participants, and address any barriers to recruitment or retention of members of the Civilian Cybersecurity Reserve; </text></subparagraph><subparagraph id="idF16743149E3C449B8CE29B53499FD35E"><enum>(C)</enum><text>the ethical requirements of the pilot project and the effectiveness of mitigation efforts to address any conflict of interest concerns; and</text></subparagraph><subparagraph id="id68E6EA85228C4A8B9D51FAD0791AC8E9"><enum>(D)</enum><text>an evaluation of the eligibility requirements for the pilot project.</text></subparagraph></paragraph></subsection><subsection id="id762e1c5d-5267-4aed-bf5f-861704bc38f3"><enum>(h)</enum><header>Evaluation</header><text>Not later than 3 years after the pilot project authorized under subsection (b) is established in the Agency, the Comptroller General of the United States shall—</text><paragraph id="ide0ec2ad1-7f20-41a3-a99d-c5513dd7a38b"><enum>(1)</enum><text>conduct a study evaluating the pilot project at the Agency; and</text></paragraph><paragraph id="idb3da9d92-2dc0-4e00-b21c-8a0289e72153"><enum>(2)</enum><text>submit to Congress—</text><subparagraph id="id7fb3e62a-7040-4b8c-b516-3d504c46eafc"><enum>(A)</enum><text>a report on the results of the study; and</text></subparagraph><subparagraph id="idc35bfe6d-1fe4-4fa8-9e9d-1dd4748fb383"><enum>(B)</enum><text>a recommendation with respect to whether the pilot project should be modified, extended in duration, or established as a permanent program.</text></subparagraph></paragraph></subsection><subsection id="id25f39cca-aae9-4002-bbb0-6ecd0279f97d"><enum>(i)</enum><header>Sunset</header><text>The pilot project authorized under this section shall terminate on the date that is 4 years after the date on which the pilot project is established.</text></subsection><subsection id="id3720b5e2-e845-456f-aa1b-ceebd1378d66"><enum>(j)</enum><header>No additional funds</header><paragraph id="idAE9B7EA926E04E3683EB7F1B68D621F7"><enum>(1)</enum><header>In general</header><text>No additional funds are authorized to be appropriated for the purpose of carrying out this Act. </text></paragraph><paragraph id="idDBE919C2F0EB448B9E274C5F9764BEDE"><enum>(2)</enum><header>Existing authorized amounts</header><text>Funds to carry out this Act may, as provided in advance in appropriations Acts, only come from amounts authorized to be appropriated to the Agency. </text></paragraph></subsection></section></legis-body><endorsement><action-date>April 27, 2022</action-date><action-desc>Reported with an amendment</action-desc></endorsement></bill> |
